shinkan-jinkendo

Author	SHA1	Message	Date
Lars	5ea225ec6b	Show a scannable QR code when setting up two-factor authentication. Some checks failed Deploy Development / deploy (push) Successful in 49s Details Test Suite / pytest-backend (push) Successful in 46s Details Test Suite / lint-backend (push) Successful in 1s Details Test Suite / build-frontend (push) Successful in 16s Details Test Suite / k6 /health Baseline (push) Successful in 34s Details Test Suite / playwright-tests (push) Failing after 5m8s Details Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-13 08:15:51 +02:00
Lars	2e22a7c8e0	Keep recovery codes on screen and make two-factor optional. Some checks failed Deploy Development / deploy (push) Successful in 51s Details Test Suite / pytest-backend (push) Successful in 46s Details Test Suite / lint-backend (push) Successful in 0s Details Test Suite / build-frontend (push) Successful in 15s Details Test Suite / k6 /health Baseline (push) Successful in 34s Details Test Suite / playwright-tests (push) Failing after 4m10s Details Admins can replace missed codes or turn two-factor off without a forced enrollment on every login. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-13 08:03:05 +02:00
Lars	32b28a93f3	Harden login, sessions, and media access before the dev deploy. Some checks failed Deploy Development / deploy (push) Successful in 49s Details Test Suite / pytest-backend (push) Successful in 47s Details Test Suite / lint-backend (push) Successful in 0s Details Test Suite / build-frontend (push) Successful in 15s Details Test Suite / k6 /health Baseline (push) Successful in 35s Details Test Suite / playwright-tests (push) Failing after 5m43s Details Limit brute-force attempts, require admin TOTP, and keep session tokens out of media URLs. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-10-13 07:45:53 +02:00

3 Commits